Solved: Unable to access a lookup created in HF on a SH cl...

bhavneeshvohra · ‎08-17-2021

Hi all,

I have created a lookup in HF ( taking batch inputs from dbconnect into a lookup)

But i am unable to access the lookup on the Search Head.

Please help.

richgalloway · ‎08-17-2021

A lookup file on a heavy forwarder is unknown and unavailable to a search head. You can either write the lookup data to an index (making it available to all SHs) or use a third-party utility like rsync to copy the lookup file to the SH.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎08-17-2021

A lookup file on a heavy forwarder is unknown and unavailable to a search head. You can either write the lookup data to an index (making it available to all SHs) or use a third-party utility like rsync to copy the lookup file to the SH.

---
If this reply helps you, Karma would be appreciated.

Unable to access a lookup created in HF on a SH cluster

using Splunk Enterprise

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Dashboards: Hiding charts while search is being executed and other uses for tokens

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

Are you a member of the Splunk Community?

Unable to access a lookup created in HF on a SH cluster

using Splunk Enterprise

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Dashboards: Hiding charts while search is being executed and other uses for tokens

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...